Re: [secdir] Secdir review of draft-ietf-ospf-rfc6506bis-03

[Brian Weis <[e-mail]>]

Hi Manav,

On Dec 5, 2013, at 11:28 AM, Warren Kumari <[e-mail]> wrote:

> 
> On Dec 4, 2013, at 8:38 PM, "Bhatia, Manav (Manav)" <[e-mail]> wrote:
> 
>> Hi Warren,
>> 
>>> 
>>> Well, you could punt all packet to the CPU and examine them to see it
>>> they are important enough to be punted to... Oh! hang on a sec :-)
>> 
>> You cant do that. You look at the incoming packet at the line card, decide what internal priority and queue the packet should take via the fabric. So there is some level of deep inspecrion and differentiation that happens at line cards. Without knowing what the ESP packet is carrying, it's hard to assign it a meaningful priority. 
>> 
> 
> Yup. That was the point I was (unsuccessfully) trying to make -- I guess the smiley was too subtle….
> 
>>> How about:
>>> "While techniques exist to identify ESP-NULL packets
>>> [RFC5879], implementing these in line cards is not currently
>>> feasible." ?
>> 
>> Sure, we can add something to this effect.
> 
> Cool.
> W

That sounds good to me too.

Thanks,
Brian

> 
>> 
>> Cheers, Manav
>> 
>>>> 
>>>> Applying heuristics requires lot of flow information to be maintained,
>>> which adds an additional complexity of flow maintenance (you need to
>>> decide when a flow needs to be deleted if its not being hit often
>>> enough) in the line cards.
>>>> 
>>>> There are many more points that go against the heuristics, especially
>>> in the context that we're discussing here. If we are ever looking at
>>> disambiguating ESP-NULL packets for router consumption, then I am pretty
>>> sure it's going to be Wrapped ESP.
>>>> 
>>>> My point is that adding text about heuristics may just confuse the
>>> reader who will most likely not understand the details of what it
>>> entails to do heuristics on a line card. While you (being the Security
>>> guru) and I (co-authored Wrapped ESP) understand that this is only
>>> theoretically possible and practically will never make sense -- the same
>>> cannot be assumed from somebody from the routing world, who is not so
>>> security savvy, going through this standard.
>>>> 
>>>> Cheers, Manav
>>>> 
>>>> _______________________________________________
>>>> secdir mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/secdir
>>>> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview
>>>> 
>>> 
>>> --
>>> The duke had a mind that ticked like a clock and, like a clock, it
>>> regularly went cuckoo.
>>> 
>>>   -- (Terry Pratchett, Wyrd Sisters)
>>> 
>> 
> 
> -- 
> No man is an island, But if you take a bunch of dead guys and tie them together, they make a pretty good raft.
>                --Anon.
> 
> 

-- 
Brian Weis
Security, Enterprise Networking Group, Cisco Systems
Telephone: [phone]
Email: [e-mail]